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On March 21, 2000, the High-Energy Solar Spectroscopic Imager (HESSI) spacecraft 
was subjected to a series of vibration tests at the Jet Propulsion Laboratory (JPL) as a part 
of its flight certification program. The structural qualification test, denoted as the sine- 
burst test, subjected the spacecraft to a major overtest that resulted in significant 
structural damage to the spacecraft. The HESSI Test Mishap Investigation Board (MIB) 
was formed on March 24, 2000, in response to a NASA headquarters request. Board 
membership included experts from NASA and the University of California at Berkeley. 
This paper will present the investigation methods, findings, and lessons learned from the 
HESSI mishap. 


INTRODUCTION 

The High Energy Spectroscopic Imager (HESSI) spacecraft primary mission objective is to explore the basic physics 
of particle acceleration and explosive energy release in solar flares. The HESSI spacecraft was scheduled for a July, 
2000, launch on a Pegasus vehicle as part of the National Aeronautics and Space Administration (NASA) Small 
Explorer Program (SMEX). On March 21, 2000, the HESSI spacecraft was being subjected to a series of vibration 
tests at JPL as a part of its flight certification program. The structural qualification test, denoted as the sine-burst 
test, subjected the spacecraft to a major overtest that resulted in significant structural damage to the spacecraft. The 
incident has been designated as a Class A mishap by NASA since the damage exceeded $1 million. 


TEST OVERVIEW 

Vibration testing of the spacecraft certifies the flight hardware to the environmental loading conditions experienced 
during the ground, captive carry and flight mission phases. Dynamic testing for a Pegasus air-launched SMEX 
payload is governed by section 4 of the Pegasus User’s Guide [I]. Three types of vibration tests were designated for 
HESSI. A low-amplitude sine survey, not a qualification test, is done to assess the fidelity of the analytical model 
and to identify the major structural resonances of the spacecraft. A random qualification test is done to account for 
the high-frequency effects of acoustically induced vibrations that occur during captive carry, launch and flight. The 
third test is a sine-burst that is done to qualify the spacecraft for structural integrity. In the sine-burst test, quasi- 
static loading is applied to the structure via an electrodynamic exciter (shaker) in lieu of a static pull or a centrifuge 
test. 

The HESSI spacecraft was mounted to an adapter ring that was then mounted to the magnesium alloy slip table via 
an aluminum fixture plate in preparation for testing in the spacecraft’s X direction. Twenty-four force gages were 
placed between the spacecraft adapter ring and the fixture plate at each of the attachment bolt locations to measure 
the force input to the spacecraft. A Ling A-249 shaker, rotated to a horizontal configuration, was attached to the slip 
table to provide lateral excitation. Two accelerometers were mounted on the fixture plate in the axis of excitation 
and provided the acceleration feedback data to the vibration control system for closed loop shaker control during 
swept sine and random vibration testing. Only one of these accelerometers was used for shaker control during sine- 
burst vibration testing. A separate instrumentation system is used to record the responses of the spacecraft 
accelerometers and force transducers. The twenty-four force gages were summed together and conditioned for use 
with force limiting during closed-loop testing. Two digital tape recorders archived the conditioned force gage data 
along with the control and response acceleration data for post-test data retrieval. One of the tape recorders recorded 
an independent monitor accelerometer, mounted next to the control accelerometer that was used to measure the input 



acceleration independently. A portion of the response channels were also acquired and processed by the vibration 
control system to be used as limit channels during random vibration or for quick-look response data. 

For testing in the X axis, runs 1 & 2 were 'A gpk sine surveys. Runs 3, 4 & 5 were various low-level random runs. 
Runs 6, 7, & 8 were full-level random runs that aborted due to instrumentation overloads. Run 9 was a successful 
full-level random run. All random runs, with the exception of run 3, utilized force limiting. Run 10 was a post- 
random 14 gpk sine survey. Run 1 1 was the sine-burst that damaged the HESSI spacecraft. 

The sine-burst for the HESSI spacecraft was specified to be 7.5 gpk in the X axis. The HESSI sine-burst X-axis test 
was to consist of a sequence of six — 12dB (14 of full level) sine-bursts followed by a single -6dB (14 of full level) 
and a single pulse full level after review of the input and some responses. On the initial — 12dB burst, an overtest of 
2Ig’s was performed, damaging the HESSI spacecraft solar arrays and structure. 


METHOD OF INVESTIGATION 

A detailed fault tree (MIB report, Appendix H-l) was developed. Test and analysis data were utilized to address 
each probable cause of the overtest. The basis for the fault tree came largely from the experience base of the MIB 
board members and historical precedent. Data were provided by the facility operating personnel that would support 
or refute portions of the fault tree. Structured interviews of the personnel involved were also utilized as data to 
support or eliminate fault tree possibilities. As the fault tree was narrowed to specific areas of concern, diagnostic 
test plans were generated and executed in an attempt to reproduce the set of conditions that resulted in the overtest in 
question. The fault tree was used for a structured analysis of the possible causes of the overtest mishap. The 
probable causes are numbered in a logical hierarchical manner with the highest levels being Facility Failure (Al) or 
Spacecraft Anomaly (A2). Each branch, with its associated causes, was analyzed and data were used to support or 
refute it. The critical mishap path was Facility Failure (Al), due to Performance Error (Al 1), caused by Slip Table 
Stiction (Al 1 1) created by Table to Granite Misalignment (Al 1 1 1) due to Shaker Position Shift (All 1 IB). The 
detailed analysis of this fault path is covered in this section. A portion of the fault tree is shown below in Figure 1. 


PERFORMANC E ERROR SUB-TREE 





SLIP TABLE SUCTION (Alll) 

Increased frictional drag in a shaker system causes the moving elements of the system to exhibit a greater than 
normal coefficient of static friction, or a condition known as stiction. Although this condition will also result in 
increased drag under dynamic conditions, its effects are greatest when two bodies are at rest. It was concluded from 
the supporting data and the personal interviews that a stiction condition was present throughout the day’s testing on 
March 21. Time history plots (Figure 2) reveal stiction during the Va gpk sine sweep of run 10. The glitches in the 
acceleration plot that occur immediately after the zero velocity points are indicative of stiction in a system. The 
acceleration glitches have large amplitudes and show very sharp drop-off rates indicating severe stiction in the 
system. Interviews of the JPL test operations personnel indicate the condition affected the random equalization as 
well. Both operators stated that when the exciter control system would begin its equalization process during the 
low-level random tests the low-frequency spectral content was initially higher than anticipated. This low-frequency 
anomaly during the initial equalization loops of the random tests resulted from poor system transfer function 
estimates brought on by stiction in the shaker system. Other test observers stated in interviews that they sensed the 
low-level random tests were loud at first with decreasing volume as the equalization process progressed for the 
particular test level. This observation corroborates the visual observation of the test operators. The response of the 
exciter system will be most affected by stiction in the lower-frequency regime where displacements are relatively 
large. A review of the control accelerometer PSD from the self-check of run 11, (Figure 3) shows the response of 
the system was poor in the low-frequency region, actually reaching a minimum at 30Hz. 

Potential causes of stiction in a slip table can be insufficient or absence of hydraulic oil flow, contaminated 
hydraulic oil, a warped slip-table, or a mechanical alignment anomaly. The possibility that the stiction was caused 
by either insufficient or no oil flow, contaminated oil, a warped slip-table or a combination of these maladies was 
systematically eliminated from consideration. 
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Figure 2 

Time-history from run 10 
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Figure 3 

PSD of self-check from run 11 


TABLE TO GRANITE MISALIGNMENT (All 11) 

The investigation into alignment anomalies focused on the granite mass, the magnesium alloy slip table that rides 
above it, and the Ling A-249 shaker. Stiction in a shaker system is often the result of some misalignment between 
two or more of the moving components in the system. These systems require precise alignment to function 
properly. This shaker system at JPL is used for both horizontal and vertical testing. The shaker must be 
repositioned from the vertical to the horizontal configuration for each 3-axis test series. Each repositioning of the 
shaker requires realignment of the slip table system. After the system is aligned, any shift in relative position of any 
of the major components can result in excessive frictional drag in the system. This drag can result in a stiction 
condition that is consistent with the data analysis. It is particularly critical that the granite mass and the slip table be 
in parallel planes and that the gap between them be consistent across the area of the slip table for the oil film type 
table to function properly. An interview with the JPL test engineer that configured the system for this test indicated 
that the system was aligned and functioning properly after it was configured for horizontal operation. As a part of 
the diagnostic testing performed, a series of measurements to quantify the gap distances between the slip table and 
the granite mass at various locations. These measurements are shown in Figure 4. These measurements show that 
the slip table and granite are not parallel and are actually in contact with each other at one location. This condition 
is consistent with the type of anomaly that was suspected as the cause of the stiction condition noted above. 
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Figure 4 

Post-incident gap measurements 


GRANITE MASS POSITION SHIFT (A1111A): 

One of the causes of a slip table to granite mass misalignment would be a shift in position of the granite mass. 
Visual inspections were performed on both the slip table and granite mass as part of the diagnostic testing. The 
granite mass did not appear to have shifted. 


SHAKER POSITION SHIFT (A1111B): 

The other cause of the slip table to granite mass misalignment would be a shift in the position of the shaker. A 
visual inspection of the shaker indicated that the shaker may have shifted on its mounting base. The north side 
mounting saddle was obviously sitting at an angle from vertical and two of the 1 diameter, grade 8 bolts that secure 
the saddles down to the base were obviously bent. Further visual inspection from the rear of the shaker revealed that 
the shaker is rotated slightly clockwise about its center axis and that the north side trunion position is low. This 
anomaly accounts for the table to granite gap measurements referenced. The slip table is affixed to the shaker 
armature by a piece of interface hardware known in the industry as a bullnose. The bullnose provides a very rigid 
attachment to the shaker armature. The shaker armature itself has both linear bearings and flexures that function to 
maintain its position and provide for uniaxial motion. The armature support and bullnose are rigid enough to 
, « Control Time History translate the shaker shift into the table misalignment 



Figure 5 

Acceleration time-history, X-axis sine-burst 


noted above. It was determined from the inspection 
that the shaker position shift was the cause of the slip 
table and granite mass misalignment that generated the 
stiction in the system that led to the overtest. 

Analysis of the time-history of the control 
accelerometer from run 1 1 (Figure 5) shows an 
interesting characteristic. The pulse ramps up 
normally from zero and reaches an amplitude plateau 
at approximately 21gpk for almost 5 full cycles before 
ramping back down to zero. Analysis of the target 
pulse (Figure 6) showed that the desired waveform 
ramps up from zero to its maximum amplitude, stays at 
maximum for only one full cycle and ramps back 
down to zero. The discrepancy in the waveforms is 
easily explained. At first glance one might interpret 
the test data as being electrically clipped, however, it is 
not clipped. Examination of the as-run test setup sheet 
(MIB report, Appendix 1-24) from the sine-burst test 
reveals that channel 1 (the control accelerometer) for 
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the controller is set for IOOmV/g. It was also seen from the as-run test procedure (MIB report. Appendix C-3) that 
the charge amplifier full-scale was set for lOOg. With a 2 1 g pulse there would be no danger of clipping the control 
channel. The shaker body provides the reaction mass that the armature force pushes against. The Ling A-249 has a 
rubber isolation system that is intended to lessen the transmitted vibration from the body of the shaker to the floor 
when the shaker is in the vertical configuration. If this isolation system is not mechanically locked out when the 
shaker is changed to the horizontal configuration, it will allow the shaker body to move if sufficient force is applied. 
The isolation system basically consists of layers or ribbed rubber pads that reside between the trunion saddle and the 
shaker base. These pads are in shear during horizontal operation and have the considerable weight of the shaker 
body, in excess of 20,000 lbs, resting on them. When the drive signal of the computer ramped up to sufficient 
amplitude such that the force in the system, approximately 45, (XX) Ibf, overcame the shear force resistance in the 
shaker isolation system the shaker body began to move. 

The body continued to react until the force ramped back down to that same amplitude at which time the shaker body 
ceased to move. Close examination of the time histories of the control accelerometer (Figure 5) and the force sum in 
the X axis (Figure 7) for the spacecraft shows that when the spacecraft mounting interface began to slip (i.e., when 
the force indication began to decrease) the acceleration peak actually rose slightly from 20g to 21.5g. This indicates 
that the reactive motion of the shaker body was slightly reduced yielding a slight increase in the measured 
acceleration at the fixture plate. This reaction of the shaker body accounts for the amplitude plateau in the 
acceleration time-history. The reactive motion of the shaker body actually acted to lessen the damage that could 
have occurred to the spacecraft. If the isolation system had been mechanically locked out, or fixed, the shaker 
system would have continued to follow the amplitude ramp up until the amplifier or shaker reached a hard limit or 
the computer drive signal ramped back down. It is noted here that the movement of the shaker body quite possibly 
exacerbated the misalignment conditions noted, however, it is evident that its movement did not cause the trunion 
condition. 

Subsequent disassembly of the shaker system by the JPL laboratory personnel revealed that the trunion support 
needle bearing on the north side of the shaker has a broken outer race and some of the rollers are loose and missing 
from the bearing housing. The underside of the slip table is also damaged. The area of contact between the slip 
table and the granite mass generated sufficient heat due to friction to cause the magnesium alloy material from the 
plate to deposit onto the granite mass. The magnesium alloy plate has an area of material loss that is consistent with 
the metallic deposit found on the granite mass. The damage to the bottom of the slip table is not consistent with a 
shock event that has duration of only a few cycles. It is consistent with several minutes of operation during which 
heat would have continued to build in that local contact area. The slip table and granite would have to operate in a 
“rubbing” condition for sufficient time to build enough heat in that area to cause the deposit of the magnesium alloy 
onto the granite mass. It is evident that the material loss of the damaged area of the slip table is not simply the result 
of abrasion. Ample evidence was collected to show the stiction condition was present throughout the day’s testing. 


Other areas addressed in the fault tree analysis are listed below along with a brief narrative of the rational for their 
consideration as a possible source of the overtest. Each listed possibility was subsequently dismissed by the MIB as 
a possible cause of the incident by review and/or analysis of the supporting data supplied by JPL personnel. The 
supporting data, analyses and other fault tree sections are not included here in the interest of brevity. A detailed 
treatise of this material is included in the MIB report [2], Appendix H-2. 

SHAKER PERFORMANCE ERROR (A112) 

Shaker system faults can cause test anomalies in several ways. Broken flexures or damaged bearings can lead to 
stiction in the system. An intermittent field coil can cause a pronounced system gain anomaly that will lead to a test 
overshoot. There are also other mechanical and electrical failures that can lead to testing anomalies. Each of these 
possibilities was investigated as a possible cause and supporting data were used to systematically eliminate them as 
a probable cause. 


AMPLIFIER PERFORMANCE ERROR (A113) 

There are some power amplifier failures that will generate overtest conditions. Supply power faults and other 
electrical failures can send catastrophic transients through the shaker system. The amplifier can also exhibit non- 
linear gain characteristics that can cause a test overshoot. Each of these possibilities was investigated as a possible 
cause and supporting data were used to systematically eliminate them as a probable cause. 

CONTROLLER OUTPUT IS INCORRECT (A 12) 

An incorrect drive signal could have been caused by an incorrect controller output signal sent to the amplifier. This 
could be caused by a software error, setup error, Digital to Analog Converter (DAC) fault, power fault, procedure 
error, or too low of a self-check. Of these, the only possible error was too low of a self-check signal. The self-check 
selected for this test works under normal circumstances, but when applied to a slip table that is binding or has 
stiction problems is unable to overcome static friction. This results in an inappropriate transfer function and hence 
an incorrect drive signal. Each of the other possibilities was investigated as a possible cause and supporting data 
were used to systematically eliminate them as a probable cause. 


CONTROLLER INPUT IS INCORRECT (A13) 

Another possible source for an incorrect drive signal is incorrect operator inputs to the controller. This includes 
calibration error, incorrect gain settings, loose accelerometer, loose cables, or a power fault. A check of test setup 
sheets (MIB report, Appendix 1-24) and an inspection of signal quality indicate that none of these errors occurred. 
Each of these possibilities was investigated as a possible cause and supporting data were used to systematically 
eliminate them as a probable cause. 


SPACECRAFT ANOMALY (A2) 

All pertinent spacecraft information was reviewed to determine if the spacecraft could have been a contributing 
factor in the sine-burst overtest. All of the accelerometer and force gage data acquired during the tests conducted on 
March 21 were reviewed. In addition, the analyses performed to calculate spacecraft modes and to demonstrate 
strength margins were reviewed. This comprehensive review of the spacecraft data provided very clear indication 
that the spacecraft did not contribute to the sine-burst overtest. As a result of this analysis it was easy to remove the 
spacecraft from the list of possible causes for the mishap. 


DYNAMIC INTERACTION WITH THE TEST FACILITY (A21) 

Severe dynamic interaction between the test article and test facility could result in the control system being unable to 
control a closed-loop test or to incorrectly calculate a transfer function for an open-loop test. Dynamic interaction 
with the test facility can be caused by non-linear behavior of the test article, excessive rattle at the interface to the 
test fixture, resonant interaction with the shaker system, or slippage between the test article and test fixture. Review 
of the force and acceleration data from the spacecraft tests conducted prior to the mishap shows that none of the 
above conditions were present. 


INADEQUATE DESIGN MARGIN (A2A) 

Most of the damage to the spacecraft during the sine-burst overtest can be traced to a failure of the Imager support 
ring. The structural margins of safety were reviewed to ensure that the spacecraft had adequate design margin to 
survive the intended sine-burst test level of 7.5g’s and to verify that the structural failure of the support ring was 
consistent with strength predictions. This review showed that the spacecraft did indeed have sufficient margin to 
survive the intended sine-burst test level and that the failure of the interface ring is consistent with pre-test strength 
analysis. 


PREVIOUS SPACECRAFT DAMAGE (A22) 

Acceleration and force data from the low-level sine sweeps were reviewed to determine if there was any indication 
of damage to the spacecraft or its interface prior to the start of the sine-burst test. If the spacecraft had been 
damaged during prior testing, this could result in a loss of structural integrity or could cause the spacecraft to 
dynamically interact with the shaker system. This type of damage could occur either to the spacecraft structure or to 
the interface between the spacecraft and the test fixture. A review of the sine sweep data shows no indication of 
damage to the spacecraft structure or the interface to the slip table. 

NOT BUILT AS DESIGNED (A23) 

The analytical prediction of structural frequencies and the determination of strength margins are based on the 
assumption that the spacecraft has been built as designed. Workmanship problems including assembly errors and 
material defects can have significant impact on the behavior of the “as-built” flight article. These types of problems 
can lead to unexpected structural behavior and can reduce structural margins during testing. The test data from the 
low-level sine sweeps were compared with analytical predictions of modes and mode shapes to determine if the 
spacecraft was built as designed. This comparison showed that the analytical model accurately characterized the 
structural behavior of the test article. This correlation activity allowed the elimination of workmanship problems 
and material defects as contributing factors to the test mishap. 


TROUBLESHOOTING SUMMARY 

As previously described, a fault tree was used along with supporting data to narrow the probable cause of the test 
overshoot to the calculation of a poor system transfer function. The cause of this poor transfer function was 
hypothesized to be a combination of stiction in the shaker system and a low-amplitude self-check for run 1 1. A 
diagnostic test plan (MIB report, Appendix 1-9) was developed that would provide a structured method for 
evaluation of the mechanical and electrical health of the system, without breaking the actual test configuration of the 
system, and attempt to replicate the overshoot condition of test 11. The plan included pre-test steps to quantify and 
record several mechanical parameters of the shaker system. Great care was taken to ensure that the system 
configuration was maintained as closely as possible to the configuration at the time of the overtest. The spacecraft 
had been removed from the table so 700 pounds of lead shot was added to the table to simulate the gravity loading 
of the spacecraft on the slip table. During the pre-test mechanical checks, anomalies in the slip table and granite 
mass were noted that supported the hypothesis of stiction in the mechanical system. At the time, there was not 
sufficient measurement equipment on hand to completely assess the flatness of the slip table so it was not possible to 
determine (later measurements showed the slip table to be flat) whether the table was tilted or warped or a 
combination of the two. For this reason, a step in the plan to check the torque of the fixture bolts was not executed 
because it was not clear whether the table anomaly was related to the interaction of the fixture plate with the slip 
table. After all pre-test checks were completed, the system was configured for the diagnostic test. A best-effort 
attempt was made to configure the system as it was before run 1 1 on March 21. It was not possible to account for 
the thermal effects of the frictional drag between the slip table and the granite mass. It was suspected that the 
frictional drag between the slip table and the granite mass during the day’s testing activities of March 21 would have 
tended to heat the local areas of both components causing even greater interference between them due to thermal 
expansion. For the diagnostic test, both the slip table and granite mass were ambient temperature. This condition 
would possibly allow for some relaxation of the interference between the table and granite, but there was no 
reasonable way to account for thermal effects that could not be quantified. 


During the first attempt to run the self-check portion of the test it was noted that several shock transients were 

propagated through the system. Review of the 
W6:wriD;»hruniticGO test data from run 11, showed no such transients 

in the system. The diagnostic test was terminated 
to obtain the relevant data from the diagnostic 
run. Analysis of the time history from the 
diagnostic test (Figure 8) showed several bursts 
that are consistent with an electrical anomaly. 
The “spikes” in the data show very sharp rise- 
times and are of considerable amplitude. These 
type transient events would tend to excite the 
resonant modes of the shaker and slip table 
system and would tend to lessen the stiction 
effects that were suspected as a contributing 
factor to the overtest. Since these anomalous 
conditions did not appear in the actual test data 
from run 11, it was determined that the condition 
should be eliminated before continuation of the 
attempt to replicate the overshoot condition. 

A second test plan (MIB report, Appendix I- II) 
was developed that would allow for isolation of 
the cause of the electrical burst noise in the test 
system. This test consisted of steps necessary to 
troubleshoot the transient problem with minimal disturbance to the system configuration. After executing the steps 
of this test the anomaly was isolated to the DAC of the vibration control system. The unit was replaced with another 
unit from a sister machine and the noise was eliminated. The DAC anomaly may have been beginning to develop 
during the sine-burst testing that damaged the spacecraft. A detailed review of the time history self-check data from 
run 11 (MIB report, Appendix I-6a) revealed some asymmetrical amplitude characteristics during the final few 
seconds of the self-check. These asymmetrical bursts could be indicative of an impending DAC failure or they 
could be RF interference. It is not possible to quantify their cause and it is not believed that they contributed to the 
incident in any way. 



Figure 8 

Time-history of diagnostic test 1 self-check 


The system having been returned to an acceptable state, the original diagnostic testing plan could now be executed. 
The system was again configured the test system per the original plan and the test was resumed. The diagnostic test 
yielded a sine-burst that had an overshoot at the -12 dB level that was outside of the acceptable tolerance range for a 
0 dB test of the HESSI spacecraft. The recreated sine-burst was lower in amplitude than the one that damaged 
HESSI; however, some difference would be expected due to the interference of the slip table and granite mass 
resulting from thermal expansion as well as the non-linear effect that stiction introduces into the system. The 
overshoot validated the hypothesis that the HESSI mishap was the result of a combination of stiction in the shaker 
system and a low-amplitude self-check. It was thus determined that the sine-burst overtest was caused by a poor 
estimate by the vibration control system of the overall gain characteristics of the shaker system. The accuracy of the 
gain estimate was compromised by the existence of intense static friction (stiction) between the granite reaction 
mass and the shaker system slip plate and a pretest self-check performed at force input levels that were too low to 
overcome the stiction in the system. The self-check is a short duration, pseudo-random noise signal that the 
controller uses as a known quantity. It emits the signal through the shaker system and characterizes the response of 
the system based on the resulting acceleration profile of the slip table. Therefore, when the pretest self-check was 
performed at very low amplitude, the control system sensed a high resistive force due to the stiction and, 
consequently, calculated a very high forcing function. This high, calculated forcing function was more than 
sufficient to overcome the stiction in the system and resulted in a large overshoot of the desired sine-burst 
amplitude. A higher self-check would have lessened the effect of the stiction on the system characterization, but 
would not have eliminated it. The root cause of the overtest condition was shown to be the stiction between the slip 
table and the granite mass. It resulted from physical contact between a portion of the slip table and the granite mass 
caused by a mechanical failure in the shaker’s support structure. The stiction caused the shaker system to present 
highly non-linear gain characteristics to the control system making it impossible for the controller to calculate an 
appropriate forcing function. 


CONTRIBUTING FACTORS TO THE INCIDENT 

Contributing factors are events or conditions that if identified, could have been used to prevent the mishap. 
Following is a list of contributing factors (MIB report, Section 9) identified by the MIB and recommendations are 
included for each contributing factor. 


1. Misalignment caused the slip table to exhibit non-linear behavior in that it would bind at low levels of force 
input. 

Recommendation: Develop metrics for routinely assessing the mechanical “health” of the shaker and slip table 
systems. This would include mechanical measurements as well as periodic test runs of the system under 
defined input levels. This data could be compared to the same data from previous measurements to identify any 
changes to the test setup that might cause an improper test condition. 

2. The test personnel did not have knowledge that data was available to assess the quality of the transfer function 
calculated from the self-check prior to initiating the sine-burst test. Post-test review of the transfer function 
used to generate the shaker drive signal for the test and examination of the drive voltage indicated that the test 
setup was not operating as expected and that an overtest could occur. 

Recommendation : Additional steps should be added to the test procedure for sine-burst and shock testing to 
review the transfer function and calculated drive voltage after the completion of the self-check and prior to 
initiating the sine-burst test. While it is not possible to set absolute standards for the transfer function and drive 
voltage values, as a minimum this data should be reviewed to ensure that the results are consistent with similar 
data from previous tests and/or a validation test for sine-burst and shock. 

3. Another contributing factor to the mishap was the lack of a facility validation test using the sine-burst on the 
shaker table before the spacecraft was mounted. It is common practice to do a facility checkout with a similar 
type of test before mounting a piece of critical hardware. 

Recommendation: Prior to arrival of the test article, all proposed tests should be simulated using levels which 
replicate as closely as possible the expected test input conditions. This serves two purposes, I) to uncover any 
problems with test equipment or test requirements prior to the start of testing and 2) to provide a baseline for 
behavior of the system prior to start of testing with the test article. This baseline data can then be used during 
testing to assess whether any changes have occurred that may adversely affect subsequent tests. The validation 
test should be done in such a way as to closely replicate actual test conditions. Control software setup, 
amplifier gains, control charge amplifier settings, self-check amplitude, test hardware gravity loading and any 
unique conditions that affect the response of the system should all be representative of the actual test conditions. 

4. One of the contributing factors to the mishap was a mechanical anomaly that occurred in the exciter system. 
The shaker, a Ling A-249, appears to have shifted in its support cradle after being coupled to the slip table in 
preparation for this test. The shift resulted in a misalignment that brought one area of the slip plate into contact 
with the granite reaction mass creating a much larger frictional drag than normal. 

Recommendation: Refurbish or replace the Ling Model A-249 shaker. 

5. Another contributing factor to the mishap was the low amplitude of the self-check used for the test. If a higher 
amplitude self-check had been used, the control software would have more closely approximated the system 
transfer function. A higher self-check would have lessened the effect of the slip plate to granite stiction and 
would have given a more accurate transfer function. 

Recommendation: Perform self-checks at appropriate levels such that the transfer function of the system will be 
representative for the force required to perform the test. 


LESSONS LEARNED 

Based on the factors associated with the mishap, the following lessons (MIB report, Section 10) learned have been 
identified: 
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Test facilities must be maintained such that the test equipment is in good working order. Metrics must be 
developed and tracked that assess the mechanical health of the systems. 

“Canned” tests should be developed and periodically utilized to provide a trended database for the test systems’ 
response. Any deviations in the system response should be investigated. 

Critical control system response data such as the transfer function or inverse transfer functions, and calculated 
drive voltage must be evaluated real-time during testing to ensure that they are reasonable and do not indicate 
system maladies. 

Facility validation test should be done for each planned test series that are representative of the actual test 
conditions before flight or critical hardware is mounted. 

Self-checks should be done that provide a representative response for the forcing range of the planned test. For 
higher force shock tests, shaker systems and test fixtures often do not respond in a linear fashion. It is also 
foolhardy to assume that test facilities are always in perfect working order. 

All test requirements should be defined in the test plan for a particular test. The test operators must have 
adequate data to enable complete verification testing before testing critical hardware. 
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